CVE-2026-34110
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
A vulnerability in the Guardian language-system allows an unauthenticated remote attacker to execute arbitrary OS commands by injecting shell metacharacters into the 'id' parameter in complex_start.php. The lack of input validation and direct use of exec() without sanitization enables full server compromise.
Risk Assessment
An attacker can fully compromise the server, steal data, install malware, or use the server for further attacks. The absence of authentication increases the risk of exploitation by anyone with network access.
Recommendation
Immediately update the Guardian language-system to the latest patched version. As a temporary measure, block access to complex_start.php and implement strict input validation and sanitization for all parameters.
Original NVD description (English source)
Guardian language-system passes the id GET parameter directly into a PHP exec() call in complex_start.php (line 14) without sanitization: exec(\"php jobs/complex.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. An unauthenticated remote attacker can append shell metacharacters to execute arbitrary OS commands on the server.